ThinkWiki - User contributions [en]

How to enable integrated fingerprint reader with BioAPI

2005-10-28T23:50:24Z

Tkilla:

Disclaimer: This is how I got the fingerprint reader on my T43 to work. It can _NOT_ yet be used to log me into the system. Working on that.

This is on {{Ubuntu}} Breezy.

The same works on Fedora Core 4.

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> grep "0483:2016" <nowiki>|</nowiki> sed -e "s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/"`}}
:It might be nessecary to put the above line into a startup script somewhere.

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
If it doesn't work, ask for help at: t43fingerprint (at) badcode.de

==GDM Login via pam_bioapi==
===Getting required libs & tools===
====Installing pam_bioapi====
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible.
The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}}
<tt><username></tt> '''must''' be the username you want to login with, gdm will probably break for any login name that has no .bir file.
*As root do:
:{{cmdroot|BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-}}
:It should print something like
:{{cmdresult|<nowiki>{</nowiki>5550454b2054464d2f45535320425350<nowiki>}</nowiki>}}
:If it does, do:
:{{cmdroot|mkdir /etc/bioapi1.10/pam`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}
:{{cmdroot|cp <username>.bir /etc/bioapi1.10/pam/`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} you can modify {{path|/etc/pam.d/common-auth}} (on Gentoo and Fedora it is file {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure

With this modification pam immediatelly starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

On Fedora, I had to add {{path|/usr/local/lib}} to my LD_LIBRARY path so that the libraries referenced from pam_bioapi.so get picked up properly.

==Make xscreensaver use the scanner==
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}}
The patch should apply with some offset, don't mind that.
If it says something about rejected though, then there's a problem.

This patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>.
Compile with
:{{cmduser|./configure --with-pam && make}}
and then install as root with
:{{cmdroot|make install}} .
Make sure that the newly compiled xscreensaver is used
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
In case it doesn't, try
:{{cmduser|1=export PATH=/usr/local/bin:$PATH}}
and retry.
:{{cmduser|xscreensaver-command -exit}}
kills your running instance of xscreensaver.
Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
now look at {{path|/etc/pam.d/xscreensaver}}.
If you're on {{Ubuntu}} Breezy and you have already changed {{path|/etc/pam.d/common-auth}} you should be good to go.
Otherwise check that the following line is at the top of the file:
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam
start the new xscreensaver
:{{cmduser|xscreensaver}}
There should be a splash screen with version 4.23.

Now try with:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

How to enable integrated fingerprint reader with BioAPI

2005-10-28T23:39:00Z

Tkilla:

Disclaimer: This is how I got the fingerprint reader on my T43 to work. It can _NOT_ yet be used to log me into the system. Working on that.

This is on {{Ubuntu}} Breezy.

The same works more or less on Fedora Core 4. PAM integration does not work yet.

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> grep "0483:2016" <nowiki>|</nowiki> sed -e "s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/"`}}
:It might be nessecary to put the above line into a startup script somewhere.

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
If it doesn't work, ask for help at: t43fingerprint (at) badcode.de

==GDM Login via pam_bioapi==
===Getting required libs & tools===
====Installing pam_bioapi====
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible.
The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}}
<tt><username></tt> '''must''' be the username you want to login with, gdm will probably break for any login name that has no .bir file.
*As root do:
:{{cmdroot|BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-}}
:It should print something like
:{{cmdresult|<nowiki>{</nowiki>5550454b2054464d2f45535320425350<nowiki>}</nowiki>}}
:If it does, do:
:{{cmdroot|mkdir /etc/bioapi1.10/pam`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}
:{{cmdroot|cp <username>.bir /etc/bioapi1.10/pam/`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} you can modify {{path|/etc/pam.d/common-auth}} (on Gentoo and Fedora it is file {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure

With this modification pam immediatelly starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

On Fedora, I had to add {{path|/usr/local/lib}} to my LD_LIBRARY path so that the libraries referenced from pam_bioapi.so get picked up properly.

==Make xscreensaver use the scanner==
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}}
The patch should apply with some offset, don't mind that.
If it says something about rejected though, then there's a problem.

This patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>.
Compile with
:{{cmduser|./configure --with-pam && make}}
and then install as root with
:{{cmdroot|make install}} .
Make sure that the newly compiled xscreensaver is used
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
In case it doesn't, try
:{{cmduser|1=export PATH=/usr/local/bin:$PATH}}
and retry.
:{{cmduser|xscreensaver-command -exit}}
kills your running instance of xscreensaver.
Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
now look at {{path|/etc/pam.d/xscreensaver}}.
If you're on {{Ubuntu}} Breezy and you have already changed {{path|/etc/pam.d/common-auth}} you should be good to go.
Otherwise check that the following line is at the top of the file:
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam
start the new xscreensaver
:{{cmduser|xscreensaver}}
There should be a splash screen with version 4.23.

Now try with:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

How to enable integrated fingerprint reader with BioAPI

2005-10-28T23:33:39Z

Tkilla: /* Installing pam_bioapi */

Disclaimer: This is how I got the fingerprint reader on my T43 to work. It can _NOT_ yet be used to log me into the system. Working on that.

This is on {{Ubuntu}} Breezy.

The same works more or less on Fedora Core 4. PAM integration does not work yet.

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> grep "0483:2016" <nowiki>|</nowiki> sed -e "s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/"`}}
:It might be nessecary to put the above line into a startup script somewhere.

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
If it doesn't work, ask for help at: t43fingerprint (at) badcode.de

==GDM Login via pam_bioapi==
===Getting required libs & tools===
====Installing pam_bioapi====
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible.
The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}}
<tt><username></tt> '''must''' be the username you want to login with, gdm will probably break for any login name that has no .bir file.
*As root do:
:{{cmdroot|BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-}}
:It should print something like
:{{cmdresult|<nowiki>{</nowiki>5550454b2054464d2f45535320425350<nowiki>}</nowiki>}}
:If it does, do:
:{{cmdroot|mkdir /etc/bioapi1.10/pam`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}
:{{cmdroot|cp <username>.bir /etc/bioapi1.10/pam/`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} you can modify {{path|/etc/pam.d/common-auth}} (on Gentoo and Fedora it is file {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure

With this modification pam immediatelly starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

On Fedora, I had to add {{path|/usr/local/lib}} to my LD_LIBRARY path so that the libraries referenced from pam_bioapi.so get picked up properly.

==Make xscreensaver use the scanner==
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}}
The patch should apply with some offset, don't mind that.
If it says something about rejected though, then there's a problem.

This patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>.
Compile with
:{{cmduser|./configure --with-pam && make}}
and then install as root with
:{{cmdroot|make install}} .
Make sure that the newly compiled xscreensaver is used
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
In case it doesn't, try
:{{cmduser|1=export PATH=/usr/local/bin:$PATH}}
and retry.
:{{cmduser|xscreensaver-command -exit}}
kills your running instance of xscreensaver.
Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
now look at {{path|/etc/pam.d/xscreensaver}}.
If you're on {{Ubuntu}} Breezy and you have already changed {{path|/etc/pam.d/common-auth}} you should be good to go.
Otherwise check that the following line is at the top of the file:
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam
start the new xscreensaver
:{{cmduser|xscreensaver}}
There should be a splash screen with version 4.23.

Now try with:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

How to enable integrated fingerprint reader with BioAPI

2005-10-28T23:32:22Z

Tkilla:

Disclaimer: This is how I got the fingerprint reader on my T43 to work. It can _NOT_ yet be used to log me into the system. Working on that.

This is on {{Ubuntu}} Breezy.

The same works more or less on Fedora Core 4. PAM integration does not work yet.

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> grep "0483:2016" <nowiki>|</nowiki> sed -e "s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/"`}}
:It might be nessecary to put the above line into a startup script somewhere.

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
If it doesn't work, ask for help at: t43fingerprint (at) badcode.de

==GDM Login via pam_bioapi==
===Getting required libs & tools===
====Installing pam_bioapi====
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible.
The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|On Fedora, configure would not complete due to a missing bioapi_util.h. I solved that by copying bioapi_util.h and installdefs.h from the above bioapi installation to /usr/local/include. Then there was a missing cssmtype.h file which I grabbed from http://sourceforge.net/projects/cdsa/.}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}}
<tt><username></tt> '''must''' be the username you want to login with, gdm will probably break for any login name that has no .bir file.
*As root do:
:{{cmdroot|BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-}}
:It should print something like
:{{cmdresult|<nowiki>{</nowiki>5550454b2054464d2f45535320425350<nowiki>}</nowiki>}}
:If it does, do:
:{{cmdroot|mkdir /etc/bioapi1.10/pam`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}
:{{cmdroot|cp <username>.bir /etc/bioapi1.10/pam/`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} you can modify {{path|/etc/pam.d/common-auth}} (on Gentoo and Fedora it is file {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure

With this modification pam immediatelly starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

On Fedora, I had to add {{path|/usr/local/lib}} to my LD_LIBRARY path so that the libraries referenced from pam_bioapi.so get picked up properly.

==Make xscreensaver use the scanner==
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}}
The patch should apply with some offset, don't mind that.
If it says something about rejected though, then there's a problem.

This patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>.
Compile with
:{{cmduser|./configure --with-pam && make}}
and then install as root with
:{{cmdroot|make install}} .
Make sure that the newly compiled xscreensaver is used
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
In case it doesn't, try
:{{cmduser|1=export PATH=/usr/local/bin:$PATH}}
and retry.
:{{cmduser|xscreensaver-command -exit}}
kills your running instance of xscreensaver.
Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
now look at {{path|/etc/pam.d/xscreensaver}}.
If you're on {{Ubuntu}} Breezy and you have already changed {{path|/etc/pam.d/common-auth}} you should be good to go.
Otherwise check that the following line is at the top of the file:
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam
start the new xscreensaver
:{{cmduser|xscreensaver}}
There should be a splash screen with version 4.23.

Now try with:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

How to enable integrated fingerprint reader with BioAPI

2005-10-28T23:28:06Z

Tkilla: /* Installing pam_bioapi */

Disclaimer: This is how I got the fingerprint reader on my T43 to work. It can _NOT_ yet be used to log me into the system. Working on that.

This is on {{Ubuntu}} Breezy.

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> grep "0483:2016" <nowiki>|</nowiki> sed -e "s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/"`}}
:It might be nessecary to put the above line into a startup script somewhere.

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
If it doesn't work, ask for help at: t43fingerprint (at) badcode.de

==GDM Login via pam_bioapi==
===Getting required libs & tools===
====Installing pam_bioapi====
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible.
The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|On Fedora, configure would not complete due to a missing bioapi_util.h. I solved that by copying bioapi_util.h and installdefs.h from the above bioapi installation to /usr/local/include. Then there was a missing cssmtype.h file which I grabbed from http://sourceforge.net/projects/cdsa/.}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}}
<tt><username></tt> '''must''' be the username you want to login with, gdm will probably break for any login name that has no .bir file.
*As root do:
:{{cmdroot|BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-}}
:It should print something like
:{{cmdresult|<nowiki>{</nowiki>5550454b2054464d2f45535320425350<nowiki>}</nowiki>}}
:If it does, do:
:{{cmdroot|mkdir /etc/bioapi1.10/pam`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}
:{{cmdroot|cp <username>.bir /etc/bioapi1.10/pam/`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} you can modify {{path|/etc/pam.d/common-auth}} (on Gentoo and Fedora it is file {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure

With this modification pam immediatelly starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

On Fedora, I had to add {{path|/usr/local/lib}} to my LD_LIBRARY path so that the libraries referenced from pam_bioapi.so get picked up properly.

==Make xscreensaver use the scanner==
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}}
The patch should apply with some offset, don't mind that.
If it says something about rejected though, then there's a problem.

This patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>.
Compile with
:{{cmduser|./configure --with-pam && make}}
and then install as root with
:{{cmdroot|make install}} .
Make sure that the newly compiled xscreensaver is used
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
In case it doesn't, try
:{{cmduser|1=export PATH=/usr/local/bin:$PATH}}
and retry.
:{{cmduser|xscreensaver-command -exit}}
kills your running instance of xscreensaver.
Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
now look at {{path|/etc/pam.d/xscreensaver}}.
If you're on {{Ubuntu}} Breezy and you have already changed {{path|/etc/pam.d/common-auth}} you should be good to go.
Otherwise check that the following line is at the top of the file:
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam
start the new xscreensaver
:{{cmduser|xscreensaver}}
There should be a splash screen with version 4.23.

Now try with:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

How to enable integrated fingerprint reader with BioAPI

2005-10-28T23:10:00Z

Tkilla: /* Configuring pam */

Disclaimer: This is how I got the fingerprint reader on my T43 to work. It can _NOT_ yet be used to log me into the system. Working on that.

This is on {{Ubuntu}} Breezy.

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> grep "0483:2016" <nowiki>|</nowiki> sed -e "s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/"`}}
:It might be nessecary to put the above line into a startup script somewhere.

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
If it doesn't work, ask for help at: t43fingerprint (at) badcode.de

==GDM Login via pam_bioapi==
===Getting required libs & tools===
====Installing pam_bioapi====
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible.
The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}}
<tt><username></tt> '''must''' be the username you want to login with, gdm will probably break for any login name that has no .bir file.
*As root do:
:{{cmdroot|BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-}}
:It should print something like
:{{cmdresult|<nowiki>{</nowiki>5550454b2054464d2f45535320425350<nowiki>}</nowiki>}}
:If it does, do:
:{{cmdroot|mkdir /etc/bioapi1.10/pam`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}
:{{cmdroot|cp <username>.bir /etc/bioapi1.10/pam/`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} you can modify {{path|/etc/pam.d/common-auth}} (on Gentoo and Fedora it is file {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure

With this modification pam immediatelly starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

On Fedora, I had to add {{path|/usr/local/lib}} to my LD_LIBRARY path so that the libraries referenced from pam_bioapi.so get picked up properly.

==Make xscreensaver use the scanner==
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}}
The patch should apply with some offset, don't mind that.
If it says something about rejected though, then there's a problem.

This patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>.
Compile with
:{{cmduser|./configure --with-pam && make}}
and then install as root with
:{{cmdroot|make install}} .
Make sure that the newly compiled xscreensaver is used
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
In case it doesn't, try
:{{cmduser|1=export PATH=/usr/local/bin:$PATH}}
and retry.
:{{cmduser|xscreensaver-command -exit}}
kills your running instance of xscreensaver.
Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
now look at {{path|/etc/pam.d/xscreensaver}}.
If you're on {{Ubuntu}} Breezy and you have already changed {{path|/etc/pam.d/common-auth}} you should be good to go.
Otherwise check that the following line is at the top of the file:
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam
start the new xscreensaver
:{{cmduser|xscreensaver}}
There should be a splash screen with version 4.23.

Now try with:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

How to enable integrated fingerprint reader with BioAPI

2005-10-28T23:06:52Z

Tkilla: /* Installing pam_bioapi */

Disclaimer: This is how I got the fingerprint reader on my T43 to work. It can _NOT_ yet be used to log me into the system. Working on that.

This is on {{Ubuntu}} Breezy.

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> grep "0483:2016" <nowiki>|</nowiki> sed -e "s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/"`}}
:It might be nessecary to put the above line into a startup script somewhere.

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
If it doesn't work, ask for help at: t43fingerprint (at) badcode.de

==GDM Login via pam_bioapi==
===Getting required libs & tools===
====Installing pam_bioapi====
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible.
The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}}
<tt><username></tt> '''must''' be the username you want to login with, gdm will probably break for any login name that has no .bir file.
*As root do:
:{{cmdroot|BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-}}
:It should print something like
:{{cmdresult|<nowiki>{</nowiki>5550454b2054464d2f45535320425350<nowiki>}</nowiki>}}
:If it does, do:
:{{cmdroot|mkdir /etc/bioapi1.10/pam`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}
:{{cmdroot|cp <username>.bir /etc/bioapi1.10/pam/`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} you can modify {{path|/etc/pam.d/common-auth}} (on Gentoo and Fedora it is file {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure

With this modification pam immediatelly starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

==Make xscreensaver use the scanner==
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}}
The patch should apply with some offset, don't mind that.
If it says something about rejected though, then there's a problem.

This patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>.
Compile with
:{{cmduser|./configure --with-pam && make}}
and then install as root with
:{{cmdroot|make install}} .
Make sure that the newly compiled xscreensaver is used
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
In case it doesn't, try
:{{cmduser|1=export PATH=/usr/local/bin:$PATH}}
and retry.
:{{cmduser|xscreensaver-command -exit}}
kills your running instance of xscreensaver.
Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
now look at {{path|/etc/pam.d/xscreensaver}}.
If you're on {{Ubuntu}} Breezy and you have already changed {{path|/etc/pam.d/common-auth}} you should be good to go.
Otherwise check that the following line is at the top of the file:
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam
start the new xscreensaver
:{{cmduser|xscreensaver}}
There should be a splash screen with version 4.23.

Now try with:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

How to enable integrated fingerprint reader with BioAPI

2005-10-28T23:06:01Z

Tkilla: /* Make xscreensaver use the scanner */

Disclaimer: This is how I got the fingerprint reader on my T43 to work. It can _NOT_ yet be used to log me into the system. Working on that.

This is on {{Ubuntu}} Breezy.

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> grep "0483:2016" <nowiki>|</nowiki> sed -e "s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/"`}}
:It might be nessecary to put the above line into a startup script somewhere.

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
If it doesn't work, ask for help at: t43fingerprint (at) badcode.de

==GDM Login via pam_bioapi==
===Getting required libs & tools===
====Installing pam_bioapi====
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible.
The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}}
<tt><username></tt> '''must''' be the username you want to login with, gdm will probably break for any login name that has no .bir file.
*As root do:
:{{cmdroot|BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-}}
:It should print something like
:{{cmdresult|<nowiki>{</nowiki>5550454b2054464d2f45535320425350<nowiki>}</nowiki>}}
:If it does, do:
:{{cmdroot|mkdir /etc/bioapi1.10/pam`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}
:{{cmdroot|cp <username>.bir /etc/bioapi1.10/pam`BioAPITest <nowiki>|</nowiki> grep -A2 Fingerprint <nowiki>|</nowiki> tail -n1 <nowiki>|</nowiki> cut -b 12-`}}

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} you can modify {{path|/etc/pam.d/common-auth}} (on Gentoo and Fedora it is file {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure

With this modification pam immediatelly starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

==Make xscreensaver use the scanner==
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}}
The patch should apply with some offset, don't mind that.
If it says something about rejected though, then there's a problem.

This patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>.
Compile with
:{{cmduser|./configure --with-pam && make}}
and then install as root with
:{{cmdroot|make install}} .
Make sure that the newly compiled xscreensaver is used
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
In case it doesn't, try
:{{cmduser|1=export PATH=/usr/local/bin:$PATH}}
and retry.
:{{cmduser|xscreensaver-command -exit}}
kills your running instance of xscreensaver.
Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
now look at {{path|/etc/pam.d/xscreensaver}}.
If you're on {{Ubuntu}} Breezy and you have already changed {{path|/etc/pam.d/common-auth}} you should be good to go.
Otherwise check that the following line is at the top of the file:
auth sufficient pam_bioapi.so {5550454b2054464d2f45535320425350} /etc/bioapi1.10/pam
start the new xscreensaver
:{{cmduser|xscreensaver}}
There should be a splash screen with version 4.23.

Now try with:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .